---
name: webcrypt-mcp
description: Teaches the agent to use the WebCrypt MCP server for AES-256-GCM symmetric encryption, RSA-4096 hybrid encryption, key generation, digital signatures, hashing, and post-quantum cryptography. Includes automated test scripts for exercising all MCP tools.
---

# Cryptographic Memory & Vault Tooling (webcrypt-mcp)

This project provides `webcrypt-mcp`, a native Model Context Protocol server for zero-dependency AES-256-GCM encryption, RSA-4096 hybrid public-key encryption, digital signatures, cryptographic hashes, and post-quantum cryptography.

## 1. Mandatory Workflow & Priority
1. **Confidential Artifacts**: Whenever saving sensitive credentials, tokens, or private workflow states, encrypt them using `encrypt_payload(mode: "data", password: "...")` or `encrypt_payload(mode: "symmetric", password: "...")`.
2. **Key Management**: Use `manage_keys(action: "generate", type: "rsa" | "ecdh" | "ecdsa" | "rsa-pss" | "hmac")` to generate cryptographically strong JWK-formatted keys for inter-agent communication.
3. **Integrity & Signatures**: Before completing tasks that produce verifiable evidence (such as evidence packs or release binaries), compute signatures or HMAC tags using `sign_verify(action: "sign", algorithm: "ECDSA" | "HMAC")`.
4. **Triple Memory Triad**:
   - `state-memory-mcp`: Workflow state tracking.
   - `vision-memory-mcp`: Visual state caching.
   - `webcrypt-mcp`: Encryption of sensitive DAG nodes, visual cache database vaults, and signature verification.

## 2. Complete Tool Reference

| Tool Name | Key Inputs | Description |
| :--- | :--- | :--- |
| `encrypt_payload` | `mode` ('symmetric' \| 'asymmetric' \| 'data'), `data`, `password`?, `public_key_jwk`? | Encrypt plaintext, JSON object, or binary data. |
| `decrypt_payload` | `mode` ('symmetric' \| 'asymmetric' \| 'data'), `ciphertext`, `password`?, `private_key_jwk`? | Decrypt ciphertext back to plaintext or structured JSON. |
| `manage_keys` | `action` ('generate' \| 'generate_random_password'), `type` ('rsa' \| 'ecdh' \| 'ecdsa' \| 'rsa-pss' \| 'hmac'), `modulusLength`?, `namedCurve`?, `length`? | Generate cryptographic keys (JWK format) or secure random passwords. |
| `crypto_hash` | `algorithm` ('SHA-256' \| 'SHA-384' \| 'SHA-512' \| 'SHA3-256' \| 'SHA3-512'), `data`, `encoding` ('hex' \| 'base64') | Compute cryptographic hash digests. |
| `sign_verify` | `action` ('sign' \| 'verify'), `algorithm` ('ECDSA' \| 'RSA-PSS' \| 'HMAC' \| 'HMAC-SHA3'), `data`, `signature`?, `password`?, `key_jwk`? | Sign or verify messages with ECDSA, RSA-PSS, or HMAC. |
| `pqc_kem_sign` | `action` ('generate_kyber_keypair' \| 'kyber_encapsulate' \| 'kyber_decapsulate' \| 'hybrid_encapsulate' \| 'hybrid_decapsulate' \| 'generate_dilithium_keypair' \| 'dilithium_sign' \| 'dilithium_verify'), `level`?, `public_key_b64`?, `private_key_b64`?, ... | Post-quantum Kyber KEM, Dilithium signatures, and Hybrid KEM. |

## 3. Automated MCP Tool Exercise & Verification
To verify that the MCP server and all 6 tools are operating correctly in the current environment:
```bash
node .agents/skills/webcrypt-mcp/scripts/exercise_tools.js
```

## 4. Agent Permissions & Auto-Run Configuration
To allow WebCrypt MCP tools to run seamlessly without interactive confirmation:
- Add `"command(webcrypt-mcp)"` or `"command(npx webcrypt mcp)"` to global agent permission grants.